Insurance, Cyberattacks, and War in Ukraine

INSIGHTi

Insurance, Cyberattacks, and War in Ukraine
April 22, 2022
The potential for large, correlated losses has long made insurers wary of offering coverage for war
damage. The first exclusions in insurance contracts for marine war risks appeared in the late 1800s. With
the relative absence of wars fought on U.S. territory, insurance against war risks has primarily been a
concern for the transportation industry, with aviation being added to marine travel over the 20th century.
The U.S. government has stepped in at various points and in various forms to ensure the availability of
insurance against war risks from the beginnings of World War I through the aftermath of the September
11, 2001 terrorist attacks. (The 9/11 terrorist attacks also prompted a federal insurance program against
terrorism risk.) While federal provision of war risk insurance is still authorized for sea and air vessels, it is
narrower than it has been in the past. The risk of cyberattacks in the 21st century, particularly in regard to
Russia’s war in Ukraine, has brought the possibility of damages directly due to wars around the globe
closer to home. Private insurance against such damage, however, may become more and more costly and
difficult to obtain.
Federal War Risk Insurance from WWI-onward
The 1914 War Risk Insurance Act (P.L. 63-193) provided coverage through the Department of the
Treasury for U.S. vessels unable to secure commercial insurance through World War I. Federal war risk
insurance was again put into place following the outbreak of World War II and authority was made
permanent for maritime transportation in 1950 (P.L. 81-763; currently codified at 46 U.S.C. §§53901-
53911). This insurance has been focused on private ships providing direct support for Department of
Defense (DOD) operations on a nonpremium basis—i.e., private ships do not pay premiums for this
coverage. The Department of Transportation’s (DOT) Maritime Administration (MARAD) operates the
insurance program and pays initial claims. Following the payments, DOT is reimbursed by DOD since the
ships are supporting DOD. MARAD also has authority to provide premium insurance—in which the
private ships pay premiums for broader federal coverage—but this authority has been used less
frequently.
From the Korean War onward, aircraft coverage became increasingly important as a growing amount of
military support was provided through the air and the amount of civilian air traffic increased. The
increased use of aircraft prompted the 1951 creation of federal war risk insurance for aircraft (P.L. 82-47;
currently codified at 49 U.S.C §44301-44310). This insurance under DOT’s Federal Aviation
Administration (FAA) is somewhat similar to the MARAD insurance. It is, however, both broader in
scope (with the authority to insure against “any risks” as opposed to primarily war risks) but more limited
Congressional Research Service
https://crsreports.congress.gov
IN11914
CRS INSIGHT
Prepared for Members and
Committees of Congress

---

Congressional Research Service
2
in time (with expiring authorities that would require reauthorization for further use). The FAA authority to
provide premium insurance, which was used widely by air carriers following 9/11, expired December 11,
2014. The FAA authority to provide nonpremium coverage extends to September 30, 2023. (For more
information on the post-9/11 program, see CRS Report R43715, Aviation War Risk Insurance:
Background and Options for Congress.)
War Damage, Cyberspace and Insurance
The relative insulation of the United States from war damage may be lessening due to the
interconnectivity fostered by the internet. For example, the 2017 NotPetya malware attack ,generally
attributed to the Russian military and aimed at Ukraine, spread around the world, causing nearly a billion
of dollars of damage to three U.S. companies alone, according to the Department of Justice. This damage
could arguably be seen as war damage, and, were such damage to occur in the context of the current
conflict in Ukraine, the argument to classify it as such would be even stronger. In addition, Russia is only
one of many states that has been seen as sponsoring some variety of cyberattack. DOD views operations
in cyberspace as a part of defending the United States and established a specific Cyber Command in
response to growing cyber threats.
Insurance against cyberdamage has increased in prominence, but such insurance is still relatively new
compared to the centuries of experience with marine insurance and the decades of experience with
aviation. The novel nature of cyberinsurance, particularly the lack of historical data on losses and legal
uncertainty about what is and is not covered by specific policy language, has led to volatility in
cyberinsurance markets. Cyberinsurance overall has been growing, but insurers have experienced
dramatically different levels of losses and policyholders have sometimes seen significant price increases.
Insurance policies often contain war risk exclusions, but such exclusions frequently have not been
specifically litigated, particularly with regard to cyberdamage. In some cases, even with the presence of
war exclusion language, courts have found that insurers may be liable for damage which could be
considered due to war. The most notable instances involve the aforementioned NotPetya attacks with
large lawsuits involving insurers and companies like Merck and Mondalez regarding the application on
war risk exclusions. The Merck case has resulted in a $1.4 billion judgment that found the war risk
exclusion did not apply, while the Mondalez case is still ongoing. The decisions in such cases may shape
cyberinsurance going forward. To avoid potentially huge damages, insurers may continue to restrict
coverage through more tightly crafted exclusions and increased prices. Similar dynamics in the past with
terrorism coverage following 9/11 led to federal intervention, and some have previously called for
something similar in cyber insurance.
Insurance and the War in Ukraine
Estimates of ultimate insured damages from the war in Ukraine are highly uncertain, but the impacted
lines of insurance are not unexpected. Substantial aviation claims are already being made, with losses
potentially in the range of $10 billion. Marine insurance is also expected to be highly impacted, as are
other specialty lines of insurance. Such insurance is increasingly expensive, if available at all, but neither
the FAA nor MARAD has announced expanded coverage under the federal war risk programs. Contrary
to some expectations, widespread cyberattacks and damage have not seemed to occur, but the President
has warned of the possibility of such attacks on the United States.

---

Congressional Research Service
3
Author Information

Baird Webel

Specialist in Financial Economics




Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff
to congressional committees and Members of Congress. It operates solely at the behest of and under the direction of
Congress. Information in a CRS Report should not be relied upon for purposes other than public understanding of
information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role.
CRS Reports, as a work of the United States Government, are not subject to copyright protection in the United
States. Any CRS Report may be reproduced and distributed in its entirety without permission from CRS. However,
as a CRS Report may include copyrighted images or material from a third party, you may need to obtain the
permission of the copyright holder if you wish to copy or otherwise use copyrighted material.

IN11914 · VERSION 1 · NEW

---